The refusal numbers are the only part of OpenAI's account where a safeguard gets measured rather than described. Astra refuses 91.5% of requests on the cyber jailbreak evaluations against 59% for GPT-5.6 Sol [12], which is 32.5 points stated the flattering way [1] and a leak-through rate of 8.5% against 41% stated the other way, or rather the more useful way, because 41 divided by 8.5 is about 4.8, and that ratio is the honest size of the gap [2]. Both figures come from runs with production safeguards switched off [13], so they grade the model and not the thing a customer will actually meet.
The launch shape is the term worth chewing on. The most advanced cyber capabilities go to a small group of alpha testers, with Daybreak Blue access widening later for defensive use [3][17], which means the capability that earned the designation is, at launch, sold to almost nobody, and OpenAI spent several weeks holding back parts of development and release to arrive at that position [7]. An allowlist does two jobs at once, gating harm and rationing supply, and from outside the company the two are indistinguishable.
The grader is the vendor. The Critical threshold comes from OpenAI's own April 2025 framework revision, which collapsed the ratings into two levels and attached development-stage safeguards to the upper one [4]; the Capabilities and Safeguards Reports go to an internal Safety Advisory Group, which recommends, and leadership decides [6]. Cybersecurity is one of three tracked categories, sitting with biological and chemical capability and AI self-improvement [5], so this route gets walked again.
On the cost of finding flaws: the internal harness held 20 high-severity V8 vulnerabilities disclosed between June and August 2026 [9], and while working through it the model turned up two zero-days that were not part of the exercise and are now being disclosed to maintainers [10], one novel bug for every ten known ones in the set [3]. OpenAI also reports much higher arbitrary code-execution rates than GPT-5.6 Sol using far fewer output tokens [9], so the unit cost of an attempt fell at the same time the hit rate rose.
This is probably wrong, but the compute ledger reads as the larger real expense here: two weeks of paused frontier training after the Hugging Face incident, larger reinforcement learning runs held back longer, the big one restarted on 28 August [14], four days before the announcement [4], and some smaller experimental runs still sitting idle [14]. Held capacity costs money whether or not a customer is billed for it. The counter-thesis deserves its hearing: the gate may be precisely what it claims, an allowlist opened at the speed defensive buyers can be vetted, and a firm engineering scarcity would not degrade its own API to do it. What would settle it is cheap to observe. If the alpha list opens to general availability within weeks with the capability claims unchanged, the gate was positioning; if security teams start reporting long agent runs dying mid-task and take their spend elsewhere, the friction was a real price paid for a self-issued grade.
